IPA IP 2026 Question 89
A question IPA Japan published in 令和8年度 ITパスポート試験 公開問題 問89, translated into English. ITPEC is based on the same exams.
Which of the following is the appropriate combination of words to be inserted into A and B in the description below concerning information security?
A cause that may have an undesirable impact on the information assets to be protected is called a A, and a weakness that may impair the value of an information asset itself is called a B.
Explanation
A: Threat, B: Vulnerability — a threat is the cause of possible harm; a vulnerability is the weakness in the asset that the threat exploits.
- •Threat: a potential cause of an unwanted impact on an information asset, coming from outside the asset: malware, unauthorized access, theft, natural disaster, an operator's mistake
- •Vulnerability: a weakness of the asset itself or of how it is managed: an unpatched OS, a weak password, a door that cannot be locked
- •Risk: the possibility that a threat exploits a vulnerability and causes loss, judged by likelihood and impact
- •Incident: an event that has actually happened and harms or may harm security
A threat does damage only through a vulnerability, which is why risk analysis looks at both.
Answer (b)
Why not others:
- •(a) — an incident is an event that has occurred, not the cause behind it; risk is the possibility of loss, not the weakness itself
- •(c) — reverses the roles of cause and weakness, and an incident is not a weakness
- •(d) — risk is the result of a threat meeting a vulnerability, not the cause; a threat is not a weakness of the asset
Key rule: Threat (cause, outside) × vulnerability (weakness, inside) → risk (possibility of loss); an incident is the risk actually materializing.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.